EUVD-2025-21283
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability has been found in Tenda FH1201 1.2.0.14(408) and classified as critical. This vulnerability affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Analysis
CVE-2025-7548 is a critical stack-based buffer overflow vulnerability in Tenda FH1201 wireless router firmware version 1.2.0.14(408) affecting the SafeEmailFilter function. An authenticated remote attacker can exploit an improper bounds check on the 'page' parameter to achieve arbitrary code execution with full system privileges (confidentiality, integrity, and availability compromise). Public exploit code exists for this vulnerability, elevating real-world risk significantly.
Technical Context
This vulnerability exists in the formSafeEmailFilter function within the /goform/SafeEmailFilter endpoint of Tenda FH1201 routers. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic stack-based buffer overflow triggered by insufficient input validation on the 'page' parameter. Tenda routers are embedded Linux-based networking appliances using proprietary web management interfaces; the vulnerable endpoint likely processes form data without proper length validation before copying to stack-allocated buffers. The attack surface is the unauthenticated or authenticated web management interface (typically port 80/443) present on consumer broadband routers used in homes and small offices worldwide.
Affected Products
Tenda FH1201 wireless router, firmware version 1.2.0.14(408). CPE representation: cpe:2.3:o:tenda:fh1201_firmware:1.2.0.14\(408\):*:*:*:*:*:*:*. The FH1201 is a mid-range 802.11ac dual-band router marketed toward home and small business users. The vulnerability likely affects other Tenda firmware versions and potentially related models (FH1202, F3, etc.) if they share the same SafeEmailFilter code, though only version 1.2.0.14(408) is explicitly confirmed as vulnerable.
Remediation
Immediate actions: (1) Tenda must release a patched firmware version addressing the buffer overflow in formSafeEmailFilter function—users should check tenda.com.cn or their regional Tenda support site for firmware updates and apply immediately; (2) Temporary mitigation: disable remote management access to the router's web interface (disable WAN access to port 80/443 in router settings) and restrict management interface access to trusted local networks only; (3) Change default credentials if not already changed; (4) Monitor for suspicious access patterns to /goform/SafeEmailFilter endpoint in router logs. Users should not delay patching given public exploit availability. Network administrators should prioritize Tenda FH1201 devices in patch management workflows.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today